telnyx-mpp-payment

Pass

Audited by Gen Agent Trust Hub on Aug 31, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill uses npx to download and execute the @stripe/link-cli (version 0.11.0) and mppx. Stripe is a well-known service, and mppx is a tool required for the skill's primary purpose of handling Telnyx Machine Payment Protocol transactions.
  • [COMMAND_EXECUTION]: The skill utilizes curl and npx to execute commands that interact with the Telnyx API (api.telnyx.com) and process payment challenges. These operations are essential for the skill's functionality and are performed using secure practices such as umask 077 and mktemp for handling sensitive response data.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes external data in the form of HTTP 402 payment challenges, creating a potential attack surface if the provider's endpoint were to return malicious content.
  • Ingestion points: Payment challenge headers and body retrieved from api.telnyx.com are saved to files (CHALLENGE_HEADERS, CHALLENGE_BODY) and passed to CLI tools.
  • Boundary markers: None identified in the prompt instructions for the CLI inputs.
  • Capability inventory: The skill uses curl for network requests and npx for executing payment processing logic via link-cli and mppx.
  • Sanitization: The skill relies on the internal logic of @stripe/link-cli and mppx to validate and process the challenge strings correctly.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 31, 2026, 11:17 PM